Legal claims defining the scope of protection. Each claim is shown in both the original legal language and a plain English translation.
1. A system, comprising: an interface configured to: receive a candidate malware potentially including at least one malicious element; a processor configured to: execute the candidate malware using a virtualized environment; determine that the candidate malware, while executing using the virtualized environment, has performed at least one anti-virtual machine action, wherein the at least one anti-virtual machine action comprises: (1) an attempt to detect whether the virtualized environment has been hotpatched; and (2) an attempt to revert a hotpatch applied in the virtualized environment; and in response to the determination that the candidate malware, while executing using the virtualized environment, has taken at least one anti-virtual machine action, generate as output an alert that the candidate malware is malicious; and a memory coupled to the processor and configured to provide the processor with instructions.
A system for detecting malware receives a potentially malicious program and runs it in a virtualized environment. While running, the system checks if the program performs "anti-VM" actions, specifically if the program tries to detect if the virtualized environment has been modified by hotpatches or tries to undo those hotpatches. If the program takes either of these actions, the system generates an alert indicating that the program is malicious. The system uses a processor and memory to execute these steps.
2. The system of claim 1 wherein generating the alert includes generating a signature associated with the candidate malware that indicates that the candidate malware is malicious.
The malware detection system described previously generates an alert that includes creating a signature for the malware, indicating it is malicious. This signature can be used to identify the malware in the future.
3. The system of claim 1 wherein the processor is further configured to determine whether the candidate malware, while executing using the virtualized environment, attempts to check whether the candidate malware is running in a virtualized environment.
In addition to the malware detection system described previously, the system also checks if the program attempts to determine if it's running in a virtualized environment at all. This is another "anti-VM" technique that can indicate malicious intent.
4. The system of claim 1 wherein the processor is further configured to determine whether the candidate malware, while executing using the virtualized environment, attempts to ascertain a product identifier of an operating system.
In addition to the malware detection system described previously, the system also checks if the program tries to find the operating system's product ID while running in the virtualized environment. Attempting to read this ID is another anti-VM technique.
5. The system of claim 1 wherein the processor is further configured to generate a random product identifier for use by the virtualized environment.
In addition to the malware detection system described previously, the system generates a fake, random product ID for the operating system in the virtualized environment. This prevents malware from detecting the true environment.
6. The system of claim 1 wherein the processor is further configured to determine whether the candidate malware attempts to ascertain a computer name.
In addition to the malware detection system described previously, the system also checks if the program tries to find the computer's name. Attempting to read the computer name is another anti-VM technique.
7. The system of claim 1 wherein the processor is further configured to generate a random computer name for use by the virtualized environment.
In addition to the malware detection system described previously, the system generates a fake, random computer name for the virtualized environment. This prevents malware from detecting the true environment.
8. The system of claim 1 wherein the processor is further configured to determine whether the candidate malware attempts to ascertain an identifier of a hard drive.
In addition to the malware detection system described previously, the system also checks if the program tries to find the hard drive's identifier (e.g., serial number). Attempting to read the hard drive ID is another anti-VM technique.
9. The system of claim 1 wherein the processor is further configured to generate a random hard drive identifier for use by the virtualized environment.
In addition to the malware detection system described previously, the system generates a fake, random hard drive identifier for the virtualized environment. This prevents malware from detecting the true environment.
10. The system of claim 1 wherein the processor is further configured to determine whether the candidate malware attempts to ascertain a MAC address.
In addition to the malware detection system described previously, the system also checks if the program tries to find the MAC address of a network interface. Attempting to read the MAC address is another anti-VM technique.
11. The system of claim 1 wherein the processor is further configured to generate a random MAC address for use by the virtualized environment.
In addition to the malware detection system described previously, the system generates a fake, random MAC address for the virtualized environment. This prevents malware from detecting the true environment.
12. The system of claim 1 wherein the processor is further configured to determine whether the candidate malware includes at least one virtualized environment-specific opcode.
In addition to the malware detection system described previously, the system checks if the program contains specific CPU instructions (opcodes) that are typically only used in virtualized environments. The presence of these opcodes can indicate malware targeting virtual machines.
13. The system of claim 1 wherein the processor is further configured to apply one or more hotpatches.
In addition to the malware detection system described previously, the system applies hotpatches to the virtualized environment. These patches can modify the environment's behavior and potentially disrupt malware.
14. The system of claim 1 wherein the processor is further configured to confirm that a previously applied hotpatch is still in effect.
In addition to the malware detection system described previously, the system verifies that previously applied hotpatches are still active and haven't been undone by the malware. This ensures the patches are effective in disrupting malware.
15. The system of claim 1 wherein the processor is further configured to determine whether the candidate malware, while executing using the virtualized environment, attempts one or more sleep actions.
In addition to the malware detection system described previously, the system monitors if the program attempts to use sleep functions. Malware may use sleep functions to delay execution and evade detection.
16. A method, comprising: receiving a candidate malware potentially including one malicious element; executing the candidate malware using a virtualized environment; determining that the candidate malware, while executing using the virtualized environment, has performed at least one anti-virtual machine action, wherein the at least one anti-virtual machine action comprises (1) an attempt to detect whether the virtualized environment has been hotpatched; and (2) an attempt to revert a hotpatch applied in the virtualized environment; and in response to the determination that the candidate malware, while executing using the virtualized environment, has taken at least one anti-virtual machine action, generating as output an alert that the candidate malware is malicious.
A method for detecting malware involves receiving a potentially malicious program and running it in a virtualized environment. While running, the method checks if the program performs "anti-VM" actions, specifically if the program tries to detect if the virtualized environment has been modified by hotpatches or tries to undo those hotpatches. If the program takes either of these actions, the method generates an alert indicating that the program is malicious.
17. The method of claim 16 further comprises determining whether the candidate malware, while executing using the virtualized environment, attempts to check whether the candidate malware is running in a virtualized environment.
The malware detection method described previously additionally determines whether the program attempts to check if it's running in a virtualized environment. This is another "anti-VM" technique that can indicate malicious intent.
18. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for: receiving a candidate malware potentially including one malicious element; executing the candidate malware using a virtualized environment; determining that the candidate malware, while executing using the virtualized environment, has performed at least one anti-virtual machine action, wherein the at least one anti-virtual machine action comprises (1) an attempt to detect whether the virtualized environment has been hotpatched; and (2) an attempt to revert a hotpatch applied in the virtualized environment; and in response to the determination that the candidate malware, while executing using the virtualized environment, has taken at least one anti-virtual machine action, generating as output an alert that the candidate malware is malicious.
A computer program stored on a non-transitory medium detects malware by receiving a potentially malicious program and running it in a virtualized environment. While running, the program checks if the program performs "anti-VM" actions, specifically if the program tries to detect if the virtualized environment has been modified by hotpatches or tries to undo those hotpatches. If the program takes either of these actions, an alert is generated, indicating that the program is malicious.
19. The method of claim 16 further comprising applying one or more hotpatches.
The malware detection method described previously also includes applying one or more hotpatches to the virtualized environment to modify its behavior, potentially disrupting the malware execution.
20. The method of claim 16 further comprising confirming that a previously applied hotpatch is still in effect.
The malware detection method described previously includes confirming that a previously applied hotpatch is still in effect, ensuring that the patch is working correctly and hasn't been removed or disabled by the malware.
Unknown
September 12, 2017
Browse 5M+ US patents with plain-English claim translations and AI-generated analysis.